Model watermarking methods, which are currently used to protect the copyright of DL models, can be employed also to protect FL models. Broadly, current watermarking schemes can be divided into two categories: white-box watermarks and black-box watermarks [1]}, [2]}. White-box approaches embed the digital watermark directly into the parameters of the DL model, and require the whole model for verification [3]}, [4]}, [5]}, [6]}. Black-box schemes use backdoor attacks [7]}, generating a unique set of data named a trigger set to embed the watermark into DL models [8]}, [9]}, [10]}, [11]}, [12]}. Compared with white-box watermarking, black-box techniques require the application programming interface (API) of a DL model instead of direct access, making them ideal for copyright verification of both DL and FL models.
